Online transactions, including financial transactions and other confidential transactions, have long been employed to allow two parties to conduct business. In a typical online transaction, the user (such as, for example, a bank customer) uses a client browser on a computer to established a session with an application server (such as, for example, the banking server that is operated by the bank) and accomplishes the desired transaction (such as, for example, transferring money from one account to another account). Since online transactions are often conducted via the Internet, which is a global public network of routers, servers, trunks, etc., security is always a paramount concern.
Risks to online transaction security include risks that an unauthorized third party may be able to obtain the authentication information (such as userid and password) and may be able to subsequently conduct fraudulent transactions to the detriment of the user. For example, if only a userid and password are required to log into a bank from any computer, a third party with access the user's userid and password would be able to log in from anywhere and perform any transaction that the user is able to perform, including for example transferring money to an account under control by the unauthorized third party.
The stealing of userid and password may be accomplished by techniques such as Trojans (generically referring to client-resident applications that snoop the userid and password as they are typed in by the user and relay the userid and password to the fraudster). Another technique involves phishing. In an example phishing scenario, the user may receive an email with a message requesting the user to log into a website purported to belong to a merchant with whom the user has previously done business (e.g., XYZ Bank). The email contains a link to be activated by the user. If the user activates the link that is provided with the phishing email, the user is presented with a website that has a substantially identical look-and-feel to that of the real website (e.g., XYZ Bank). However, this website actually belongs to the fraudster. Information entered by the user into the fraudster's website, which mimics the look-and-feel of the real website, would be recorded and used to subsequently perpetrate fraud on the user. By way of example, the fraudster may employ the entered userid and password to log into the account of the user and perform an unauthorized transfer of money.
Pharming is another type of attack that has been employed to practice frauds on users. In pharming, the DNS (Domain Name System) table is poisoned so that when the user types in the URL associated with the service provider, that URL would be translated into an IP address associated with the attacking pharming website. The user is then taken to the attacking pharming website, which may attempt to mimic the service provider website in order to obtain the login credentials of the users. Once the login credentials are acquired, fraudsters may subsequently use those login credentials to practice frauds on users, such as to fraudulently withdraw money from the user's bank account.
The aforementioned touches only on some broad categories of online transaction risks. There are other risks currently existing and they are well known and will not be belabored here. Further, techniques are continually developed to combat online fraud. In response, the fraudsters continually develop techniques to defeat the newly implemented security measures, including authentication schemes.
One method of combating frauds such as Trojans, phishing, or pharming involves using second factor authentication, wherein additional information is required for authentication. With the userid/password acting as the first authenticating factor, the application server (e.g., the bank application), also requires additional authentication based on hardware that is possessed by the device being used for access or by the user. For example, a hardware token or ATM card may be required for the second factor authentication.
However, hardware second factor authentication is both expensive to implement for the service provider and cumbersome for the user.
In view of the transaction risks that are currently existing and/or that are being developed in response to security measures, improved authentication techniques are desired.